diff --git a/.gitea/workflows/dev.yml b/.gitea/workflows/dev.yml
new file mode 100644
index 0000000..0893062
--- /dev/null
+++ b/.gitea/workflows/dev.yml
@@ -0,0 +1,70 @@
+name: build-dev
+
+on:
+  # Every push to dev: build, run the offline test suite, publish to the
+  # dev Attic cache.
+  push:
+    branches: [dev]
+
+jobs:
+  nix-build:
+    runs-on: build-server
+    steps:
+      # actions/checkout@v4 is unreliable on host-mode runners (its files are
+      # copied into the workspace instead of the repo), so clone explicitly.
+      - name: Checkout
+        run: |
+          rm -rf ./* ./.[!.]* 2>/dev/null || true
+          git config --global http.extraheader "Authorization: token ${{ github.token }}"
+          git clone --branch "${{ gitea.ref_name }}" \
+            "${{ gitea.server_url }}/${{ gitea.repository }}.git" .
+          test -f flake.nix
+          git log --oneline -1
+
+      - name: Inspect workspace
+        run: |
+          pwd
+          ls -la
+          git rev-parse --show-toplevel 2>&1 || true
+          git remote -v 2>&1 || true
+          git describe --tags --always 2>&1 || true
+          test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
+
+      # Dev builds fingerprint as the short commit hash.
+      # Persisted via GITHUB_ENV so the impure nix eval below reads it via
+      # builtins.getEnv.
+      - name: Compute version
+        run: |
+          echo "APP_VERSION=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
+
+      # checks is keyed per-system (checks.<system>.default); nix build's
+      # #attr shorthand can't resolve it, so resolve the current system inline.
+      # --impure lets the flake read APP_VERSION via builtins.getEnv
+      # (pure evals always get the package defaults). The offline test suite
+      # runs in the package's checkPhase.
+      - name: Build + offline test suite
+        run: nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" --impure
+
+      - name: Live portal tests
+        env:
+          RWT_LIVE_ACCOUNT_EMAIL: ${{ secrets.RWT_LIVE_ACCOUNT_EMAIL }}
+          RWT_LIVE_LICENSE_EMAIL: ${{ secrets.RWT_LIVE_LICENSE_EMAIL }}
+          RWT_LIVE_LICENSE_KEY: ${{ secrets.RWT_LIVE_LICENSE_KEY }}
+        run: |
+          nix develop --command bash -c '
+            cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
+            cmake --build build --target test_api_client test_license_service
+            ./build/test_api_client
+            ./build/test_license_service
+          '
+
+      # Dev closure lands in the dev cache.
+      - name: Push to Attic dev cache
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
+        run: |
+          nix profile install github:zhaofengli/attic#attic-client \
+          --extra-experimental-features "nix-command flakes"
+
+          attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
+          attic push radiantwave:radiantwave-dev ./result
diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/main.yml
similarity index 70%
rename from .gitea/workflows/build.yml
rename to .gitea/workflows/main.yml
index baa8bcc..8c9cdcb 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/main.yml
@@ -1,9 +1,8 @@
-name: build
+name: build-main
 
 on:
-  # Manual only for now. Select the branch to build when dispatching:
-  #   main -> APP_VERSION is the current git tag
-  #   dev  -> APP_VERSION is the current commit hash
+  # Manual only. Dispatch against main: build, run the offline test suite,
+  # publish to the release Attic cache.
   workflow_dispatch:
 
 jobs:
@@ -12,8 +11,8 @@ jobs:
     steps:
       # actions/checkout@v4 is unreliable on host-mode runners (its files are
       # copied into the workspace instead of the repo), so clone explicitly.
-      # A full clone (no --depth) is required so `git describe --tags` on main
-      # resolves the real nearest tag instead of falling back to a hash.
+      # A full clone (no --depth) is required so `git describe --tags` resolves
+      # the real nearest tag instead of falling back to a hash.
       - name: Checkout
         run: |
           rm -rf ./* ./.[!.]* 2>/dev/null || true
@@ -32,18 +31,12 @@ jobs:
           git describe --tags --always 2>&1 || true
           test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
 
-      # Compute the version string baked into the binary's Home footer:
-      # main reports the git tag, dev reports the commit hash fingerprint.
-      # The key stays in the build step's environment (never echoed).
+      # Release builds report the current git tag.
+      # Persisted via GITHUB_ENV so the impure nix eval below reads it via
+      # builtins.getEnv.
       - name: Compute version
-        id: version
         run: |
-          if [ "${{ gitea.ref_name }}" = "main" ]; then
-            APP_VERSION="$(git describe --tags --always)"
-          else
-            APP_VERSION="$(git rev-parse --short HEAD)"
-          fi
-          echo "Branch: ${{ gitea.ref_name }} -> APP_VERSION=$APP_VERSION"
+          echo "APP_VERSION=$(git describe --tags --always)" >> "$GITHUB_ENV"
 
       # checks is keyed per-system (checks.<system>.default); nix build's
       # #attr shorthand can't resolve it, so resolve the current system inline.
@@ -66,10 +59,13 @@ jobs:
             ./build/test_license_service
           '
 
-      - name: Push to Attic cache
+      # Release closure lands in the release cache.
+      - name: Push to Attic release cache
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_PROD }}
         run: |
           nix profile install github:zhaofengli/attic#attic-client \
           --extra-experimental-features "nix-command flakes"
 
-          attic login radiantwave https://attic.radiantwavetech.com "${{ secrets.ATTIC_TOKEN }}"
-          attic push radiantwave ./result-kiosk ./result-android ./result-commercial
+          attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
+          attic push radiantwave:radiantwave ./result